Effective Now: Increased Prohibitions on Unauthorized Possession of Personal Identification Information

Technology   |   Intellectual Property   |   December 1, 2013
Download Download   
Share Share Page

Under a new Florida law, a person’s use or possession of personal identification information (PII) of five or more individuals gives rise to an inference that the action was intentionally performed knowingly and without authorization, unless the person can provide a satisfactory explanation for the conduct. On October 1, 2013, Florida Statute Section 817.5685, made it a crime to intentionally or knowingly possess, without authorization, the PII of another person in any form (including hard copy or electronic). Prior to this statute, Florida already had a law on the books criminalizing the fraudulent use, or possession with intent to fraudulently use PII concerning an individual without authorization or that individual’s consent, and that law remains effective.

The statute defines PII to include medical records, financial information (including bank account numbers, credit or debit card numbers), and government identification information (including Social Security numbers, driver license numbers, government-issued identification numbers, alien registration numbers, passport numbers, employer or tax identification numbers, and Medicaid or food assistance account numbers).

The statute exempts the following:

(1) "the parent or legal guardian of a child and who possesses the personal identification information of that child";

(2) a guardian of another person for the possession of PII of that other person, if the guardian is authorized to possess the PII and make decisions regarding that PII;

(3) a government agency employee who possesses the PII of another person in the ordinary course of business;

(4) a person engaged in a lawful business and possesses PII of another person in the ordinary course of business; and

(5) a person who finds government-issued documentation containing PII "of another person and who takes reasonably prompt action to return that" document to "its owner, to the governmental agency that issued the card or document, or to a law enforcement agency."

In the early stages of this statute’s effectiveness, it is unclear whether the possession of legally-acquired PII for a temporal period longer than needed by a financial services institution would be considered "the ordinary course of business" or a violation of the new statute.

However, the statute creates two affirmative defenses to alleged violations of the statute for cases where the person possessing the PII of another person (1) "did so under the reasonable belief that such possession was authorized by law or by the consent of the other person," or (2) obtained the PII from a public record, or other "forum or resource that is open or available to the general public."

Violations of the statute are punishable as a first degree misdemeanor, in the case of a person possessing PII of four people or less, and as a third degree felony, in the case of a person possessing the PII of five or more people.

©2023 Carlton Fields, P.A. Carlton Fields practices law in California through Carlton Fields, LLP. Carlton Fields publications should not be construed as legal advice on any specific facts or circumstances. The contents are intended for general information and educational purposes only, and should not be relied on as if it were advice about a particular fact situation. The distribution of this publication is not intended to create, and receipt of it does not constitute, an attorney-client relationship with Carlton Fields. This publication may not be quoted or referred to in any other publication or proceeding without the prior written consent of the firm, to be given or withheld at our discretion. To request reprint permission for any of our publications, please use our Contact Us form via the link below. The views set forth herein are the personal views of the author and do not necessarily reflect those of the firm. This site may contain hypertext links to information created and maintained by other entities. Carlton Fields does not control or guarantee the accuracy or completeness of this outside information, nor is the inclusion of a link to be intended as an endorsement of those outside sites.

Subscribe to Publications


The information on this website is presented as a service for our clients and Internet users and is not intended to be legal advice, nor should you consider it as such. Although we welcome your inquiries, please keep in mind that merely contacting us will not establish an attorney-client relationship between us. Consequently, you should not convey any confidential information to us until a formal attorney-client relationship has been established. Please remember that electronic correspondence on the internet is not secure and that you should not include sensitive or confidential information in messages. With that in mind, we look forward to hearing from you.